Privacy Policy

belajarhosting.com ("the service", "we") decides how the personal data described here is used, and is responsible for it under the law of the Republic of Indonesia on the protection of personal data.

Everything about your data goes to support@belajarhosting.com: a question, a request, a complaint.

We keep what the service needs to work, and nothing to advertise with.

• Your account. Your name and email address, your password as a hash that cannot be turned back into the password, the moment you agreed to the terms, and when two-factor authentication is on, its secret (stored encrypted) and your recovery codes (as hashes).
• Your teams. The teams you are in, your role in each, and the servers of a team you may see when an admin chose some for you. The people in a team see the name and email address of everybody in it.
• Invitations. When a member of a team invites somebody: the email address it is for, which may belong to somebody without an account, the role offered, and who sent it.
• Your logins. For every device you are logged in on: the IP address, the browser it reports, and when it was first and last used. Failed logins are counted for a short time, to stop guessing.
• Your servers. The name you give a server, and what its agent reports: host name, operating system, processor, memory, the IP address it connects from, and the port and user of its SSH server with its host keys. We also keep the SSH key pair the service made for that server. Its private half is stored encrypted.
• Measurements. CPU, load, memory, swap, disks and network use over time, and the busiest processes with their name, their user and what they use. The command line of a process is never sent, because it can hold a password.
• What the pages of a server read. The pages for the files, services, processes, logs, scheduled jobs, firewall, websites and databases of a server read them from the server over SSH when you open them, command lines and the content of files included. That is passed on to your browser and not stored; so are the files you upload or download, on their way through our servers. What you change there, such as which service you restarted or which file you saved, goes into the record of actions, by its name and path but without its content. A password the databases page makes is shown to you once and never stored. Getting an HTTPS certificate on the websites page has your server ask Let's Encrypt for one for its domains, without an email address; we send them nothing.
• Backups. When you set up backups for a server: the address, region and bucket of your storage, its access key ID, its secret key (stored encrypted), and which folders and databases are backed up when. For every backup and restore: when it ran, how it went, the size of the archive and the messages the server printed while making it, which can name files. The archives themselves go from your server to your storage and back; we never receive or keep them. To list, delete and download them, the service asks your storage for the names and sizes of the archives in that bucket folder.
• Terminal sessions. For every session: who opened it, from which IP address, when and for how long. Only if you choose so when opening it: the commands you entered, and a recording of what the screen showed, which is stored encrypted.
• The AI assistant. Your questions, its answers, the commands it ran or proposed with their output, and what you decided about them.
• Alerts and Telegram. The alerts about your servers. If you connect Telegram: the ID of your chat with our bot, and your Telegram username and first name.
• Payments. Your invoices: amount, status and dates. We do not see or store the bank account, card or e-wallet you pay from.
• A record of actions. What was done to your servers and to the members of your team through the service, by which account and when.

• To run the service for you: show your servers, open terminals, answer your questions to the assistant, send alerts, and let the people in a team work on its servers together. This is what you signed up for under the Terms of Service.
• To keep accounts and servers safe: recognize your devices, limit failed logins, and keep a record of what was done.
• To handle payments and keep the records of them that the law asks for.
• To write to you about your account: the verification link, a password reset, receipts, and a notice when your plan ends. An invitation to a team is sent to the address a member of that team entered, because they asked for it. We send no advertising.

The assistant does not run on our servers alone. To answer a question, the service sends the following to the company that provides the language model:

• your question and the conversation so far;
• what the assistant reads on your server while it works on the answer: the content of files, lines of logs, the output of commands, and details and measurements of the server.

This is sent only to produce the answer. It may be processed outside Indonesia. What is on your server can contain personal data of other people, or secrets. Reading a file that typically holds secrets, such as a key or an environment file, therefore waits for your approval, and you can decline it. Do not ask the assistant to read what you are not allowed to share.

If you never use the assistant, nothing of your servers is sent to that company.

We do not sell your data and do not give it to advertisers. These companies process it for us, each only for its task:

• the hosting company our servers run at;
• Cloudflare, which carries the traffic between your browser and our servers;
• Supabase, which hosts the database;
• Resend, which delivers our email to you;
• KlikQRIS, which takes your payment and tells us when it arrived;
• Telegram, when you connect it, to deliver alerts to your chat;
• the provider of the language model, as described in section 4.
• the storage you chose for backups, when you set them up: that company receives your archives from your server, under your own agreement with it.

We give data to an authority only when the law obliges us to, and then no more than it asks for.

The service runs on servers in Indonesia. Some of the companies in section 5 store or process data in other countries. Where that is the case, we use them only if they protect personal data at least as well as Indonesian law asks, and by creating an account you agree to this transfer.

• Measurements: for the number of days your plan states on the pricing page.
• Terminal recordings: 7 days. Terminal sessions and their commands: 90 days.
• Alerts that are over: 30 days.
• Logins: until you log out, and for 30 days at most.
• Invitations: until they are accepted, declined or withdrawn, and 7 days at most.
• A team its owner deleted: its members and invitations go at once. Its name and its invoices stay for as long as the law requires invoices to be kept.
• Conversations with the assistant: 7 days after their last message, or until you delete them, if that is sooner.
• Backups: the settings until you stop backing a server up, and what each backup and restore did for 90 days. The archives in your storage are yours: we delete only the ones beyond the number you chose to keep, and those you delete.
• Invoices: for as long as the law requires records of payments to be kept.
• The record of actions: 7 days.
• Your account: until it is deleted.

Removing a server deletes its SSH key, its measurements, its terminal sessions and recordings, its alerts, its backup settings and the conversations about that server alone. Its archives stay in your storage. A conversation about all your servers stays for its 7 days, with what the assistant found on that server.

• The connection between your browser, your servers and the service is encrypted.
• SSH private keys, two-factor secrets and terminal recordings are stored encrypted, under a key that is kept outside the database.
• Passwords, session tokens and recovery codes are stored as hashes only.
• Access to the systems behind the service is limited to those who run it.

No system is perfectly safe. If personal data of yours is exposed, we tell you and the authority in charge within the time the law sets, with what happened and what we are doing about it.

The service sets one cookie, which keeps you logged in. It cannot be read by scripts and is sent to belajarhosting.com only. Your browser also remembers a few choices on your device, such as the light or dark theme and which announcements you closed; these are not sent to us. There are no advertising or analytics trackers on the site.

The law gives you rights over your personal data. You can ask us to:

• tell you what we hold about you and give you a copy of it;
• correct what is wrong or out of date;
• delete your account and the data that belongs to it;
• stop or limit a use of your data, or take back a consent you gave;
• hand your data to you in a form another service can read.

Write to support@belajarhosting.com from the email address of your account. We answer within the time the law sets. Much of it you can do yourself in the dashboard: change your name, remove servers, delete conversations, disconnect Telegram.

When you ask us to delete your account, we delete it with the team that was made with it, that team's servers and everything listed in section 2 within 30 days, except the invoices the law requires us to keep. From the teams of others you are taken out; what you did on their servers stays in their record of actions for its 7 days. Taking back your consent means the account has to be closed, because the service cannot work without this data.

If you are not satisfied with our answer, you can complain to the authority that supervises the protection of personal data in Indonesia.

The service is made for adults who manage servers. Somebody under 18 may use it only with the permission of a parent or guardian. If you believe a child has an account without that permission, write to us and we will close it.

When what we store or how we use it changes, this text changes with it, and the date on top tells when. For a change that matters to you, such as a new company that receives data, we tell you by email or in the dashboard before it applies.